[PufPufPuf]

Isn't that what PyInstaller already does? It bundles your Python app with a runtime. I've seen a few apps distributed like this, even GUI ones.

[vorticalbox]

Yes, bit for malware you want your dropper to be small and lightweight so it can be downloaded and ran very quickly.

Hence and vb script that downloads python, they could have hosted the rat and downloaded that too rather than writing it line by line.